{"record":{"id":"84d7b0e49f11585a","repo":"microsoft/aspire","slug":"the-provided-certificate-must-have-a-valid-public-key","errorCode":null,"errorMessage":"The provided certificate must have a valid public key.","messagePattern":"The provided certificate must have a valid public key\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting/ApplicationModel/HttpsCertificateAnnotation.cs","lineNumber":42,"sourceCode":"    {\n        get => _certificate;\n        init\n        {\n            if (value != null && _useDeveloperCertificate == true)\n            {\n                throw new ArgumentException(\"Cannot set both UseDeveloperCertificate and Certificate properties.\", nameof(value));\n            }\n\n            if (value?.HasPrivateKey == false)\n            {\n                throw new ArgumentException(\"The provided certificate must have a private key.\", nameof(value));\n            }\n\n            try\n            {\n                if (value != null && value.PublicKey == null)\n                {\n                    throw new ArgumentException(\"The provided certificate must have a valid public key.\", nameof(value));\n                }\n            }\n            catch (CryptographicException ex)\n            {\n                throw new ArgumentException(\"The provided certificate is invalid.\", nameof(value), ex);\n            }\n\n            _certificate = value;\n        }\n    }\n\n    /// <summary>\n    /// Gets or sets a value indicating whether the resource should use a platform developer certificate for its key pair.\n    /// </summary>\n    public bool? UseDeveloperCertificate\n    {\n        get => _useDeveloperCertificate;\n        init","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting/ApplicationModel/HttpsCertificateAnnotation.cs#L24-L60","documentation":"During Certificate init validation the annotation also checks that the certificate exposes a public key (value.PublicKey). If the key is null it throws ArgumentException; if reading the key raises CryptographicException that path instead produces the 'provided certificate is invalid' error. This specific throw means the X509 object parsed but carries no usable public key.","triggerScenarios":"Assigning a corrupt or synthetic X509Certificate2 instance (e.g. built from truncated/blank PEM data that still constructs) to HttpsCertificateAnnotation.Certificate.","commonSituations":"Certificates generated or transformed programmatically (PEM re-wrapping, base64 mangling in config/env substitution); corrupted mount/secret contents in containers.","solutions":["Regenerate or re-export the certificate from a trusted source and verify openssl x509 -noout -pubkey succeeds.","Verify the PEM/secret content end-to-end (no truncated base64, correct headers) before loading.","Load the certificate in a probe before constructing the annotation and access cert.PublicKey yourself to catch the problem early with a clear message.","If the cert comes from a mounted secret, check the secret mount and file contents in the deployment environment."],"exampleFix":"// before\nvar cert = new X509Certificate2(Convert.FromBase64String(envCert));\nvar annotation = new HttpsCertificateAnnotation { Certificate = cert }; // may throw here\n// after\nvar cert = new X509Certificate2(Convert.FromBase64String(envCert));\nif (cert.PublicKey is null) throw new InvalidOperationException(\"Certificate material has no public key; re-export cert.pfx.\");\nvar annotation = new HttpsCertificateAnnotation { Certificate = cert };","handlingStrategy":"validation","validationCode":"// before assigning\nif (cert is not null)\n{\n    _ = cert.PublicKey ?? throw new InvalidOperationException(\"Certificate has no public key; re-export a valid certificate.\");\n}","typeGuard":"static bool HasPublicKey(this X509Certificate2? cert) =>\n    cert is not null && cert.PublicKey is not null;","tryCatchPattern":"try\n{\n    var annotation = new HttpsCertificateAnnotation { Certificate = cert };\n}\ncatch (ArgumentException ex) when (ex.Message.Contains(\"public key\"))\n{\n    // regenerate/re-export the certificate\n}","preventionTips":["Sanity-check loaded certs with cert.PublicKey?.Key before use.","Avoid programmatic PEM re-wrapping that can corrupt base64 payloads.","Regenerate suspicious certificates from the CA rather than patching bytes.","Validate secrets/env vars supplying cert material at configuration load time."],"tags":["dotnet","aspire","https","certificate","x509"],"backgroundTag":"invalid-argument-value","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}